Go module

github.com/tilt-dev/tilt

v0.34.2

Newer version available

Published

April 11, 2025

Links

Origin: https://pkg.go.dev/github.com/tilt-dev/tilt@v0.34.2
Repo: https://github.com/tilt-dev/tilt

Projects

tilt-dev/tilt

GitHub

Define your dev environment as code. For microservice apps on Kubernetes.

336 forks

9k stars

OpenSSF scorecard

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

View information about checks and how to fix failures.

Score

2.9/10

Scorecard as of June 2, 2025.

Code-Review

1/10

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

Reasoning

Found 4/25 approved changesets -- score normalized to 1

Maintained

10/10

Determines if the project is "actively maintained".

Reasoning

26 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10

CII-Best-Practices

0/10

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

Reasoning

no effort to earn an OpenSSF best practices badge detected

Security-Policy

0/10

Determines if the project has published a security policy.

Reasoning

security policy file not detected

License

10/10

Determines if the project has defined a license.

Reasoning

license file detected

Fuzzing

0/10

Determines if the project uses fuzzing.

Reasoning

project is not fuzzed

Signed-Releases

0/10

Determines if the project cryptographically signs release artifacts.

Reasoning

Project has not signed or included provenance with any releases.

Binary-Artifacts

10/10

Determines if the project has generated executable (binary) artifacts in the source repository.

Reasoning

no binaries found in the repo

SAST

0/10

Determines if the project uses static code analysis.

Reasoning

SAST tool is not run on all commits -- score normalized to 0

Pinned-Dependencies

0/10

Determines if the project has declared and pinned the dependencies of its build process.

Reasoning

dependency not pinned by hash detected -- score normalized to 0

Vulnerabilities

0/10

Determines if the project has open, known unfixed vulnerabilities.

Reasoning

23 existing vulnerabilities detected

Project metadata as of June 13, 2025.

This site uses cookies from Google to deliver its services and to analyze traffic.

Pinned-Dependencies

Info: Possibly incomplete results: error parsing shell code: "foo(" must be followed by ): vendor/sigs.k8s.io/controller-runtime/Makefile:0

Warn: containerImage not pinned by hash: .circleci/Dockerfile:2: pin your Docker image by updating cimg/go:1.24-node to cimg/go:1.24-node@sha256:4bcc46dcb0a58e99e538afd2ae6d60431a40530108cf72f6401b4676c07e2f62

Warn: containerImage not pinned by hash: .circleci/Dockerfile.integration:2: pin your Docker image by updating cimg/go:1.24-node to cimg/go:1.24-node@sha256:4bcc46dcb0a58e99e538afd2ae6d60431a40530108cf72f6401b4676c07e2f62

Warn: containerImage not pinned by hash: Dockerfile.toast:1: pin your Docker image by updating golang:1.12-alpine to golang:1.12-alpine@sha256:3f8e3ad3e7c128d29ac3004ac8314967c5ddbfa5bfa7caa59b0de493fc01686a

Warn: containerImage not pinned by hash: integration/analytics/Dockerfile:1: pin your Docker image by updating busybox to busybox@sha256:f85340bf132ae937d2c2a763b8335c9bab35d6e8293f70f606b9c6178d84f42b

Warn: containerImage not pinned by hash: integration/crd/Dockerfile:1: pin your Docker image by updating busybox to busybox@sha256:f85340bf132ae937d2c2a763b8335c9bab35d6e8293f70f606b9c6178d84f42b

Warn: containerImage not pinned by hash: integration/dcbuild/Dockerfile:1: pin your Docker image by updating alpine to alpine@sha256:8a1f59ffb675680d47db6337b49d22281a139e9d709335b492be023728e11715

Warn: containerImage not pinned by hash: integration/disable/Dockerfile:1: pin your Docker image by updating busybox to busybox@sha256:f85340bf132ae937d2c2a763b8335c9bab35d6e8293f70f606b9c6178d84f42b

Warn: containerImage not pinned by hash: integration/event/Dockerfile:1: pin your Docker image by updating busybox to busybox@sha256:f85340bf132ae937d2c2a763b8335c9bab35d6e8293f70f606b9c6178d84f42b

Warn: containerImage not pinned by hash: integration/idempotent/Dockerfile:1: pin your Docker image by updating busybox to busybox@sha256:f85340bf132ae937d2c2a763b8335c9bab35d6e8293f70f606b9c6178d84f42b

Warn: containerImage not pinned by hash: integration/ignores/Dockerfile:1: pin your Docker image by updating busybox to busybox@sha256:f85340bf132ae937d2c2a763b8335c9bab35d6e8293f70f606b9c6178d84f42b

Warn: containerImage not pinned by hash: integration/imagetags/app-stretch/Dockerfile:1: pin your Docker image by updating busybox to busybox@sha256:f85340bf132ae937d2c2a763b8335c9bab35d6e8293f70f606b9c6178d84f42b

Warn: containerImage not pinned by hash: integration/imagetags/app/Dockerfile:1: pin your Docker image by updating busybox to busybox@sha256:f85340bf132ae937d2c2a763b8335c9bab35d6e8293f70f606b9c6178d84f42b

Warn: containerImage not pinned by hash: integration/imagetags/common-stretch/Dockerfile:1: pin your Docker image by updating busybox to busybox@sha256:f85340bf132ae937d2c2a763b8335c9bab35d6e8293f70f606b9c6178d84f42b

Warn: containerImage not pinned by hash: integration/imagetags/common/Dockerfile:1: pin your Docker image by updating busybox to busybox@sha256:f85340bf132ae937d2c2a763b8335c9bab35d6e8293f70f606b9c6178d84f42b

Warn: containerImage not pinned by hash: integration/job/Dockerfile:1: pin your Docker image by updating busybox to busybox@sha256:f85340bf132ae937d2c2a763b8335c9bab35d6e8293f70f606b9c6178d84f42b

Warn: containerImage not pinned by hash: integration/job_fail/app.dockerfile:1: pin your Docker image by updating busybox to busybox@sha256:f85340bf132ae937d2c2a763b8335c9bab35d6e8293f70f606b9c6178d84f42b

Warn: containerImage not pinned by hash: integration/job_fail/db-init.dockerfile:1: pin your Docker image by updating busybox to busybox@sha256:f85340bf132ae937d2c2a763b8335c9bab35d6e8293f70f606b9c6178d84f42b

Warn: containerImage not pinned by hash: integration/job_fail/db.dockerfile:1: pin your Docker image by updating busybox to busybox@sha256:f85340bf132ae937d2c2a763b8335c9bab35d6e8293f70f606b9c6178d84f42b

Warn: containerImage not pinned by hash: integration/job_reattach/app.dockerfile:1: pin your Docker image by updating busybox to busybox@sha256:f85340bf132ae937d2c2a763b8335c9bab35d6e8293f70f606b9c6178d84f42b

Warn: containerImage not pinned by hash: integration/job_reattach/db-init.dockerfile:1: pin your Docker image by updating busybox to busybox@sha256:f85340bf132ae937d2c2a763b8335c9bab35d6e8293f70f606b9c6178d84f42b

Warn: containerImage not pinned by hash: integration/job_reattach/db.dockerfile:1: pin your Docker image by updating busybox to busybox@sha256:f85340bf132ae937d2c2a763b8335c9bab35d6e8293f70f606b9c6178d84f42b

Warn: containerImage not pinned by hash: integration/live_update_after_crash_rebuild/Dockerfile:1: pin your Docker image by updating busybox to busybox@sha256:f85340bf132ae937d2c2a763b8335c9bab35d6e8293f70f606b9c6178d84f42b

Warn: containerImage not pinned by hash: integration/live_update_base_image/app/Dockerfile:3

Warn: containerImage not pinned by hash: integration/live_update_base_image/app/Dockerfile:7

Warn: containerImage not pinned by hash: integration/live_update_base_image/base/Dockerfile:1: pin your Docker image by updating busybox to busybox@sha256:f85340bf132ae937d2c2a763b8335c9bab35d6e8293f70f606b9c6178d84f42b

Warn: containerImage not pinned by hash: integration/live_update_selector/Dockerfile:1: pin your Docker image by updating busybox to busybox@sha256:f85340bf132ae937d2c2a763b8335c9bab35d6e8293f70f606b9c6178d84f42b

Warn: containerImage not pinned by hash: integration/live_update_two_images_one_manifest/Dockerfile.sparkle:1: pin your Docker image by updating busybox to busybox@sha256:f85340bf132ae937d2c2a763b8335c9bab35d6e8293f70f606b9c6178d84f42b

Warn: containerImage not pinned by hash: integration/live_update_two_images_one_manifest/Dockerfile.tada:1: pin your Docker image by updating busybox to busybox@sha256:f85340bf132ae937d2c2a763b8335c9bab35d6e8293f70f606b9c6178d84f42b

Warn: containerImage not pinned by hash: integration/namespaceflag/Dockerfile:1: pin your Docker image by updating busybox to busybox@sha256:f85340bf132ae937d2c2a763b8335c9bab35d6e8293f70f606b9c6178d84f42b

Warn: containerImage not pinned by hash: integration/onedc/Dockerfile:1: pin your Docker image by updating alpine to alpine@sha256:8a1f59ffb675680d47db6337b49d22281a139e9d709335b492be023728e11715

Warn: containerImage not pinned by hash: integration/oneup/Dockerfile:1: pin your Docker image by updating busybox to busybox@sha256:f85340bf132ae937d2c2a763b8335c9bab35d6e8293f70f606b9c6178d84f42b

Warn: containerImage not pinned by hash: integration/oneup_custom/Dockerfile:1: pin your Docker image by updating busybox to busybox@sha256:f85340bf132ae937d2c2a763b8335c9bab35d6e8293f70f606b9c6178d84f42b

Warn: containerImage not pinned by hash: integration/onewatch/Dockerfile:1: pin your Docker image by updating busybox to busybox@sha256:f85340bf132ae937d2c2a763b8335c9bab35d6e8293f70f606b9c6178d84f42b

Warn: containerImage not pinned by hash: integration/onewatch_exec/Dockerfile:1: pin your Docker image by updating busybox to busybox@sha256:f85340bf132ae937d2c2a763b8335c9bab35d6e8293f70f606b9c6178d84f42b

Warn: containerImage not pinned by hash: integration/restart_process_different_user/Dockerfile:1: pin your Docker image by updating busybox to busybox@sha256:f85340bf132ae937d2c2a763b8335c9bab35d6e8293f70f606b9c6178d84f42b

Warn: containerImage not pinned by hash: integration/same_img_multi_container/Dockerfile:1: pin your Docker image by updating busybox to busybox@sha256:f85340bf132ae937d2c2a763b8335c9bab35d6e8293f70f606b9c6178d84f42b

Warn: containerImage not pinned by hash: scripts/protobuf-helper.dockerfile:1: pin your Docker image by updating golang:1.24 to golang:1.24@sha256:db5d0afbfb4ab648af2393b92e87eaae9ad5e01132803d80caef91b5752d289c

Warn: containerImage not pinned by hash: scripts/release.Dockerfile:8

Warn: containerImage not pinned by hash: scripts/release.Dockerfile:10

Warn: containerImage not pinned by hash: scripts/release.Dockerfile:16: pin your Docker image by updating golang:1.24-bullseye to golang:1.24-bullseye@sha256:12152217ef79f60fd71a64375d818b7be68c69c7611ca471c2e2c28324cbf4cd

Warn: containerImage not pinned by hash: scripts/tilt.Dockerfile:15: pin your Docker image by updating docker/tilt-ctlptl to docker/tilt-ctlptl@sha256:5282697ea8f2de574cf3f9d82471312cab4aaad623bac3470d460c54a0728241

Warn: containerImage not pinned by hash: web/Dockerfile:1: pin your Docker image by updating node:16.14-bullseye-slim to node:16.14-bullseye-slim@sha256:d54981fe891c9e3442ea05cb668bc8a2a3ee38609ecce52c7b5a609fadc6f64b

Warn: goCommand not pinned by hash: .circleci/Dockerfile:30-32

Warn: goCommand not pinned by hash: .circleci/Dockerfile:30-32

Warn: downloadThenRun not pinned by hash: .circleci/Dockerfile:34

Warn: goCommand not pinned by hash: .circleci/Dockerfile.integration:52-53

Warn: goCommand not pinned by hash: Dockerfile.toast:16

Warn: goCommand not pinned by hash: Dockerfile.toast:17

Warn: goCommand not pinned by hash: Dockerfile.toast:18

Warn: goCommand not pinned by hash: Dockerfile.toast:19

Warn: goCommand not pinned by hash: scripts/protobuf-helper.dockerfile:7

Warn: goCommand not pinned by hash: scripts/protobuf-helper.dockerfile:8

Warn: goCommand not pinned by hash: vendor/github.com/agext/levenshtein/test.sh:5

Warn: goCommand not pinned by hash: vendor/github.com/json-iterator/go/build.sh:10

Warn: npmCommand not pinned by hash: vendor/github.com/smacker/go-tree-sitter/test_grammar_generate.sh:5

Info: 0 out of 42 containerImage dependencies pinned

Info: 1 out of 12 goCommand dependencies pinned

Info: 0 out of 1 downloadThenRun dependencies pinned

Info: 0 out of 1 npmCommand dependencies pinned